I'm not sure you can, the use of "zpool history" as a audit function would be quite worthless if it could be tampered with. After all, if you know that only 100 lines are kept, its quite easy to generate a 100 snapshot commands to fill it up..